Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others

calif.io

Post reply on HN
Print view View original

51–60 of 62 posts

Re: OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others

#51

Post by ForHackernews »

fc417fc802 wrote: post #49
ForHackernews wrote: post #43

Earlier quoted context omitted.

It's not quick, but you can submit a GDPR/Subject Access Request to Twilio and after a month or two they will send you all your Authy TOTP seeds. Then you can import them into Aegis or some other FLOSS solution: https://github.com/uiltondutra/authy-migrate

That is alarming. They have access to the plaintext? And they will hand auth secrets out? That seems extremely wrong to me.

>...data arrives as a CSV in which every token is encrypted with your backup password...

Re: OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others

#52

Post by close04 »

throwa356262 wrote: post #20
ArtTimeInvestor wrote: post #9

A good security track record must be the most valuable company asset in history. Apple makes $200B per year from selling the iPhone alone. Plus the services they sell on it, plus deals like the one with Google, plus app store ads, plus cross-selling of other hardware ... I have one too. Not because I like the hardware too much. Pixel phones are much nicer, they don't wobble when you put them on a table. Not because I…

The issue is that Android is open while Apple seldom talks about their security issues. This might make Apple look like the more secure option but the reality may be different because Android is more scrutinised. If you are sceptical consider these examples: (1) some versions of Apple silicon have unpatchable security defects, (2) Apple at one point decided to not contact up to 500M users affected by a supply chain a…

> Apple seldom talks about their security issues

I didn't find about OEMpocalypse from Google talking about their security issues, I found from calif.io. Security researchers don't wait for companies to "talk about their security".

> but the reality may be different because Android is more scrutinised.

This is famously why Linux appears to be less secure than Windows, right? Because Microsoft doesn't talk about their security while Linux is more scrutinized?

Re: OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others

#53

Post by fc417fc802 »

ForHackernews wrote: post #51
fc417fc802 wrote: post #49

Earlier quoted context omitted.

That is alarming. They have access to the plaintext? And they will hand auth secrets out? That seems extremely wrong to me.

>...data arrives as a CSV in which every token is encrypted with your backup password...

Fair enough. That seems reasonable.

Re: OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others

#54

Post by Gander5739 »

rickdeckard wrote: post #41
Gander5739 wrote: post #39

Earlier quoted context omitted.

What's stopping you from rooting it and then sshing in? You can then run the adb commands using root access.

> What's stopping you from rooting it (probably the broken USB port)

Isn't the article about obtaining root from an unprivileged app? The recent GhostLock exploit is potentially usable for this purpose, for instance.

Re: OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others

#55

Post by exdeejay_ »

gorgmah wrote: post #15

Slightly unrelated: is it relatively safe to root android phones nowadays or should I stick to the unrooted standard android? The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app).

AFAIK rooting an Android phone necessitates a factory reset of the phone beforehand, so I don't think you'd be able to dump the MFA seeds before Authy is uninstalled (unless that's a hardware thing)

Re: OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others

#56

Post by veeti »

FrequentLurker wrote: post #28

I wonder if there is a vulnerability that allows for toggling wireless adb. I have an LG with android 12 which technically should support wireless ADB but LG stripped the option from settings. Some say they stripped out the feature entirely. On top of that the USB port is damaged and doesnt accept data but still accepts power. So no wired adb either.

If you can get root and a terminal emulator on the device, you could try something like "adb shell settings put global adb_wifi_enabled 1".

Re: OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others

#57

Post by KetoManx64 »

torben-friis wrote: post #17
gorgmah wrote: post #15

Slightly unrelated: is it relatively safe to root android phones nowadays or should I stick to the unrooted standard android? The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app).

The main issue is that many apps will block rooted phones (banks, state apps and the like). Usually more trouble than it's worth.

* some apps.

Both of my banking apps work fine with a rooted GrapheneOS phone. If you want to have full control over your phone like you would a Linux laptop, to customize it to your own preferences and maximize privacy, there is nothing else gives you the same amount of control over the device that you bought and paid for.

The fact that people pay $1000 for a device and then not be able to fully uninstall pre-installed crapware nor fully block it from the internet is depressing.

Re: OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others

#58

Post by KetoManx64 »

fc417fc802 wrote: post #47
gorgmah wrote: post #15

Slightly unrelated: is it relatively safe to root android phones nowadays or should I stick to the unrooted standard android? The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app).

The answer really depends. Root by what means? And to what end? Permanent or only temporarily? Personally I reject with extreme prejudice the android security model (it's my &#^@ device not the vendor's). But I don't generally want to grant any apps root. Lineage strikes a nice balance by providing root adb.

I want the ability to grant specific apps root through Magisk. Tasker for example for tasks that change system level settings and adaway for system level adblocking, material files for accessing to root filesystem for pulling config files from apps, Swift Backups for backing up all my apps and their data.

Re: OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others

#59

Post by ece »

rickdeckard wrote: post #45
ece wrote: post #29

You'd almost think supporting a phone for a longer amount of time might actually be better than trying to sell a new phone every year or two.

Only if you find a way to create revenue beyond the time-of-purchase, to offset the cost of development and maintenance, aka service revenue. So far only Apple achieved this by ensuring a walled garden around their ecosystem, securing additional revenue-share for every single 3rd party app and every transaction of the user. All other vendors are structurally prevented to properly compete in services, and have to rely…

This would be a bit convincing if there weren't other hardware and services providers like Fairphone, GrapheneOS and Google themselves, who do support and maintenance for longer.

Re: OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others

#60

Post by kvuj »

cromka wrote: post #24
ArtTimeInvestor wrote: post #9

A good security track record must be the most valuable company asset in history. Apple makes $200B per year from selling the iPhone alone. Plus the services they sell on it, plus deals like the one with Google, plus app store ads, plus cross-selling of other hardware ... I have one too. Not because I like the hardware too much. Pixel phones are much nicer, they don't wobble when you put them on a table. Not because I…

It's a bit ironic to think Apple takes security seriously when they infamously delivered ridiculous bugs like 2017 High Sierra root login, which they fixed and then accidentally unfixed again. What we're seeing is marketing/branding and a genuine for-show effort, all the while they do not audit their code outside some for-show technologies (Siri AI in the cloud). So the point I am making is that it's all observationa…

Funny since the GrapheneOS devs praise the iPhone for it's security.

I personally prefer seeing real advancement that integrate both hardware and software like their EMTE[1] which no other vendor has had the balls to implement.

And I say that as a GOS user! My next phone will definitely be an iPhone, mostly because I cannot deal with the terrible Tensor SOC. My G4 overheats for nothing! Shameful

[1] https://security.apple.com/blog/memory-integrity-enforcement...

Post reply on HN